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We propose a two-way secure-communication protocol in which Alice uses an amplified sponta¬ 
neous emission source while Bob employs binary phase-shift keying and an optical amplifier. Against 
an eavesdropper who captures all the light lost in fibers linking Alice and Bob, this protocol is capable 
of 3.5 Gbps quantum-secured direct communication at 50 km range. If Alice augments her terminal 
with a spontaneous parametric downconverter and both Alice and Bob add channel monitors, they 
can realize 2 Gbps quantum key distribution at that range against an eavesdropper who injects her 
own light into Bob’s terminal. Compared with prevailing quantum key distribution methods, this 
protocol has the potential to significantly increase secure key rates at long distances by employing 
many ultrabroadband photons per key bit to mitigate channel loss. 
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Quantum key distribution (QKD) allows a random bit¬ 
string to be shared between remote parties with secu¬ 
rity vouchsafed by the laws of quantum mechanics EHl. 
Were its secret-key rate equal to the desired communica¬ 
tion rate, QKD would enable full information-theoretic 
security by means of one-time pad encryption. Unfor¬ 
tunately, demonstrated secret-key rates fall far short of 
what is needed for widespread use of one-time pad en¬ 
cryption. At present, therefore, QKD’s principal appli¬ 
cation is to rekey classical cryptosystems, making over¬ 
all security that of the classical system. In this regard, 
quantum-secured direct communication (QSDC) [H, 
may be preferable to key distribution, especially if it can 
be done at high rates. Quantum illumination (QI) [3- 

is an entanglement-based two-way protocol that has 
the potential to accomplish that goal, but in its present 
form has two major drawbacks, which will be described 
below. In this Letter we report a new protocol, based on 
QI, that eliminates these drawbacks and offers unprece¬ 
dented rate-versus-distance capability. The new protocol 
realizes passive eavesdropping immunity—i.e., immunity 
to an Eve who merely listens to light leaking out of the 
connections between Alice and Bob—without the use of 
entanglement. That immunity is shown to arise from 
the no-cloning theorem, as is the case for the security 
of both discrete-variable and continuous-variable QKD. 
Entanglement does come into play, however, in making 
the new protocol resistant to active eavesdropping, i.e., 
when Eve injects her own light into Bob. We begin our 
development with a description of the QI protocol as it 
provides the foundation for what will follow. 

In QI, Alice creates entangled signal and idler beams 
and transmits the signal to Bob while retaining the idler. 
Bob modulates the light he receives from Alice using bi¬ 
nary phase-shift keying (BPSK), amplifies the modulated 
light to boost the signal strength and mask his message 
with amplified spontaneous emission (ASE) noise, and 
returns the resulting light to Alice. Owing to the ini¬ 


tial entanglement, Alice can recover Bob’s message while 
a passive eavesdropper cannot. The first drawback of 
QI is its vulnerabilty to active eavesdropping, which is a 
major concern for QI carried out over optical fibers. Nev¬ 
ertheless, we will postpone discussing how active eaves¬ 
dropping might be defeated until we address QI’s other 
drawback, which limits its rate-versus-distance capability 
even when Eve only employs passive eavesdropping. 

Suppose that the protocol from [3] is used on a hber 
channel, as shown in Fig. 1. Here: (1) Alice employs 
a continuous-wave (cw) spontaneous parametric down- 
converter (SPDC) source, with phase-matching band¬ 
width W and brightness (average photon number/s-Hz) 
Ns 1, transmits the signal beam to Bob over a fiber 
link of transmissivity Kg 1, and stores her idler beam 
in a fiber loop of transmissivity k/; (2) Bob uses i?bps 
BPSK to encode his message and an erbium-doped fiber 
amplifier (EDFA) of gain ^ 1 and ASE output noise 
of brightness Nb = to mask his message; and (3) 
Alice recovers Bob’s message with the best known re¬ 
ceiver for that task, viz., the optical parametric ampli¬ 
fier (OPA) receiver 0- The OPA receiver requires Al¬ 
ice to store her idler for a time equal to the roundtrip 
propagation delay between Alice and Bob, making kj = 
k|. The error probability of Alice’s receiver then sat¬ 
isfies Pr(e)°j^^ ~ ex^—2WKsGBNs/RNB)/‘2, assum¬ 
ing ideal equipment iEl. In contrast. Eve’s passive- 
eavesdropping error probability for her (realization un¬ 
known) optimum quantum receiver obeys Pr(e)g’^g ~ 
exp{—4WKsGBNB/RN b)/2 [3, [HI, assuming that she 
collects all the light lost en route between Alice and 
Bob. The KgNs versus KsNg disparity between Al¬ 
ice and Eve’s error exponents provides Alice and Bob 
with direct-communication security against this passive- 
eavesdropping individual attack when the former sub¬ 
stantially exceeds the latter [13. Alice’s Ns versus 7V| 
advantage derives from the maximally-entangled nature 
of the phase-sensitive cross correlation between the signal 
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FIG. 1; (color online). Setups for Ql-secured direct communi¬ 
cation in the presence of passive eavesdropping. In the proto¬ 
col from 0, Alice’s source is a continuous-wave spontaneous 
parametric downconverter whose signal she sends to Bob and 
whose idler she retains as a reference for the optical paramet¬ 
ric amplifier receiver from M- For the new protocol, Alice 
employs a source of amplified spontaneous emission noise to 
send a low-brightness signal to Bob while retaining a high¬ 
brightness copy for use as the local oscillator in a broadband 
balanced-homodyne receiver. 

and idler emitted by her SPDC source, while her ver¬ 
sus Ks disadvantage is due to her needing an idler-storage 
fiber that is twice as long as the Alice-to-Bob hber. 

An alternative QI architecture that avoids this idler- 
loss scaling was introduced in [^. It replaces Bob’s 
single-channel BPSK modulator with K independent 
dense wavelength-division multiplexed (DWDM) BPSK 
modulators that encode rate Rc bps data on nonover¬ 
lapping Wc Hz slices of the signal spectrum, and it re¬ 
places Alice’s OPA receiver with K DWDM homodyne 
receivers for the matching spectral bands of her idler 
and the light returned to her from Bob. Because ho¬ 
modyne detection of the idler can be done immediately, 
with delay-locking performed post-detection, Alice’s er¬ 
ror probability for each DWDM channel is given by 
~ exp{-WcKsGBNs/RcNB)/2 with ideal 
equipment i El- Unfortunately, the implementation 
burden for this architecture is overwhelming: 50 DWDM 
channels with Wc = 40 GHz bandwidth would be needed 
to fully populate a W = 2THz phase-matching band¬ 
width, and each of those channels would need a high¬ 
speed analog-to-digital converter to retain the informa¬ 
tion required to realize the error probability given above. 
Thus, the DWDM architecture is not a satisfactory so¬ 
lution to the idler-storage problem. In its stead we pro¬ 
pose replacing Alice’s SPDC source with an ASE source 
(e.g., an EDFA), and her OPA receiver with a broad¬ 
band (single-channel) balanced-homodyne receiver. The 
ASE source’s high brightness permits a low-brightness 
portion of its output to be sent to Bob; such light can 
perfectly mimic what Bob (and a passively eavesdropping 
Eve) would see were Alice to have used an SPDC source. 


However, because Alice now retains high-brightness ASE 
light that is perfectly correlated with what she is send¬ 
ing to Bob, fiber-spool storage for the roundtrip delay 
is no longer problematic, i.e., she can use optical am¬ 
plifiers in her storage system with insignificant error- 
exponent (signal-to-noise ratio) penalty [l^. Moreover, 
this bright stored light is exactly what is needed as the 
local oscillator (LO) for broadband homodyne reception 
of the light returned by Bob. Now, Alice’s error prob¬ 
ability, with ideal equipment, is given by Pr(e)Afi^g ~ 
exp{—WKsGBNs/RNB)/2 [l^, while the passive- 
eavesdropping Eve’s optimum quantum receiver’s perfor¬ 
mance is still Pr(e)g'^g ^ exp{—4WKsGBNg/RNB)/2. 
Comparing the asymptotic expressions for Pr(e)2i^^ and 
Pr(e)^fi^g reveals that the latter loses a factor of two in 
its error exponent compared to the former, but gains 
a much larger benefit by virtue of its immunity to the 
idler-storage loss that plagues the SPDC-based system. 
Another benefit afforded by Alice’s switching to an ASE 
source is that she can optimize her secure rate by choos¬ 
ing the brightness of the signal light she sends to Bob 
over a much wider range than is available from an SPDC 
source. This is because the bulk-optics cw SPDC sources 
that produce maximally-entangled signal and idler out¬ 
puts are generally limited to Ns < 10“^, but commer¬ 
cial EDFAs can yield output brightness as high as 10^, 
from which any desired Ns < 1 signal brightness is eas¬ 
ily obtained. We also note that the upper bound from 
[8| on Eve’s passive-eavesdropping Holevo information as 
a function of Alice’s Ns also applies, unchanged, when 
Alice uses an ASE source. 

Figure 2(a) compares QI’s secure-rate-versus-distance 
performance when Alice uses the ASE-source/homodyne- 
receiver setup proposed herein, in lieu of the SPDC- 
source/OPA-receiver configuration from Q, and a 
passive-eavesdropping Eve mounts an optimum collec¬ 
tive attack. The curves therein are secure-rate lower 
bounds for the SPDC and ASE systems obtained from 
= P^ab - Xb|, where Iab is Alice and Bob’s 
Shannon information rate, is an upper bound on 

Eve’s Holevo information rate, and (3 is the efficiency 
of the error-correcting code employed by Alice and Bob 
0. Both curves assume that: (1) Alice and Bob are con¬ 
nected by fibers with 0.2dB/km loss; (2) Alice’s source 
has 2 THz bandwidth; (3) the brightness Ns of the signal 
light Alice sends to Bob and the bit rate i? < 10 Gbps of 
Bob’s BSPK modulator are chosen to maximize A/^®; 
(4) Bob’s amplifier has gain Gb = 10^ and output ASE 
with brightness Nb = 10^; and (5) Eve collects all light 
lost en route between Alice and Bob. For the SPDC/OPA 
system, Alice stores her idler in fiber with 0.2dB/km 
loss, and she chooses her OPA’s gain Ga —in conjunction 
with her Ns and Bob’s R —to maximize Her re¬ 

ceiver’s photodetector quantum efficiency is 0.9, its band¬ 
width is sufficient to accommodate 10 GHz BPSK, and 
/3 = 1 is assumed. For the ASE/homodyne system, Al- 
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FIG. 2: (color online), (a) Lower bounds on Alice and 
Bob’s secure rates when Eve mounts a collective passive- 
eavesdropping attack, (b) Signal brightness, Ns, at which 
these secure rates are realized. See text for additional details. 


ice’s reference—i.e., her A^lo = 10"^ brightness LO—is 
presumed to be stored without degradation, her homo¬ 
dyne receiver’s efficiency is 0.9 0 , and its bandwidth is 
sufficient for 10 GHz BPSK. In addition, her error prob¬ 
ability is constrained to satisfy Pr(e)Au^e — making 
her /3 = 0.94 achievable at Pr(e)^K^= 0.1 with a rate- 
1/2 low-density parity-check code [15|. All other aspects 
of both systems are ideal. 

There are several points worthy of note regarding the 
results shown in Fig. 2(a). The first is a reminder that 
Alice and Bob’s passive-eavesdropping immunity applies 
to QSDC, in addition to QKD. The second is that ob¬ 
viating Alice’s storage loss by use of ASE light provides 
an enormous increase in secure-rate-versus-distance per¬ 
formance. Indeed, the ASE/homodyne system is capable 
of a 3.5 Gbps secure rate over 50 km of low-loss fiber, 
whereas the SPDC/OPA system’s secure rate is about 
10^-times lower at that distance. A third, more funda¬ 
mental, point concerns the physical basis for this pas¬ 
sive eavesdropping immunity. Prior work ascribed QI’s 
passive-eavesdropping immunity to the entanglement be¬ 
tween the signal and idler beams produced by Alice’s 
SPDG source , making its experimental demonstra¬ 
tion the first realized example of entanglement’s bene¬ 
fit surviving an entanglement-breaking channel. Alice’s 
switching to an ASE source to provide both her low¬ 
brightness signal and high-brightness local oscillator im¬ 
plies that entanglement is not necessary to realize im¬ 
munity to passive eavesdropping. With the ASE source, 
security now rests on the no-cloning theorem, i.e.. Eve 
is unable to obtain a high-brightness version of the sig¬ 
nal light Alice sends to Bob with which to make her 
own high-quality homodyne measurement of Bob’s mes¬ 
sage. Finally, we point out that, over the path lengths 
shown, the optimum i? < 10 Gbps value without the 
Pr(e)Aiice < 0.1 constraint is 10 Gbps. Thus the abrupt 
slope change in Fig. 2(a)’s ASE/homodyne curve occurs 
when R must be reduced to satisfy that constraint. It 
follows that Alice and Bob’s secure-rate/distance region 
can be increased if both the modulation rate and error- 


probability constraints are relaxed, as could be done with 
advances in modulator technology and further develop¬ 
ment of high-efficiency error-correcting codes. 

Now let us return to the issue of defeating an active 
attack. Our proposal for defeating such attacks is shown 
in Fig. 3. Alice passively combines signal light from 
a bandwidth W, brightness iVspDC SPDG source with 
light from highly-attenuated, bandwidth W ASE source 
in a 1:99 ratio, resulting in a bandwidth W, brightness 
Ns signal beam that she sends to Bob. Alice uses a 
single-photon counter to detect photons from her SPDG 
source’s idler beam, and retains her bright ASE light for 
use as a broadband homodyne LO. Because Alice and 
Bob will be monitoring the power levels and power spec¬ 
tra at their respective terminals. Eve minimizes her ex¬ 
posure and maximizes her Holevo information by: (1) 
replacing the 0.2dB/km fibers connecting Alice and Bob 
with her own lossless fibers; ( 2 ) injecting signal light from 
an SPDG source identical to Alice’s into the Alice-to-Bob 
channel through a beam splitter, while preserving the 
power level and spectrum seen by Bob; and (3) withdraw¬ 
ing some light from the Bob-to-Alice channel through an¬ 
other beam splitter, while preserving the power level and 
spectrum seen by Alice. Alice and Bob’s security rests on: 
(1) their measuring the singles rates for Alice’s detection 
of SPDG idler photons and Bob’s detection of photons he 
has tapped from the light he received from Alice; and ( 2 ) 
their monitoring the coincidence rate for these measure¬ 
ments. That coincidence rate is degraded, relative to the 
singles rates, by Eve’s light injection. In particular, Al¬ 
ice and Bob’s singles (Sa and Sb) and coincidence {Cab) 
rates obey [l3| Sa = ? 7 .^sdpcM^, Sb = tjkbi^sNsW , and 
Cab = SASBTg + kb f ks kaNspbcW . Here: 77 is the 
detection efficiency of Alice and Bob’s monitors; ka ~ 0.9 
is the fraction of Alice’s SPDG signal light that is coupled 
into the fiber going to Bob; ks = is the trans¬ 

missivity of the L-km-long fibers connecting Alice and 
Bob; Kb =0.1 is the fraction of the light Bob receives 
that he routes to his monitor; Tg = 100 ps is the gate 
time of Alice and Bob’s monitors; and / is the fraction 
of the light received by Bob that came from Alice. 

Figure 4(a) shows a lower bound on Alice and Bob’s 
secure rate, = PIab — Xbbj ia the presence of the 

active-eavesdropping Eve 0 when their monitoring en¬ 
sures that / = 0.99. Also included is a brightness plot 
for the light Alice sends to Bob. These curves were ob¬ 
tained assuming that: ( 1 ) the brightness of the signal 
Alice sends to Bob and Bob’s bit rate i? < 10 Gbps are 
chosen to maximize their secure rate subject to the con¬ 
straint that Pr(e)Aiice < 0.1 so that /3 = 0.94 can be as¬ 
sumed; ( 2 ) Alice’s homodyne receiver has an undegraded 
local oscillator with brightness Apo = 10 ^ and efficiency 
0.9; and (3) all other system aspects are ideal. We see 
that 2 Gbps QKD is possible at 50 km range. 

At this juncture, there are two points worth discussing. 
First, there is a major distinction to be drawn between 
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FIG. 3: (color online). Setup for defeating active eavesdrop¬ 
ping by coincidence monitoring. 



FIG. 4: (color online), (a) Lower bound on Alice and Bob’s se¬ 
cure rate when Eve mounts a collective active-eavesdropping 
attack, and the signal brightness, Ns, at which this bound is 
realized. See text for additional details, (b) Secure rate in 
bits per mode versus one-way path loss: comparison between 
the Takeoka-Guha-Wilde (TGW) bound, ideal continuous- 
variable (GV) QKD, and the ASE/homodyne protocol from 
Fig. 3 whose performance (in bits/sec) is shown in (a). 


the active and passive cases. It will take a time Tm for 
Alice and Bob to verify, from their measured singles and 
coincidence rates, that Eve’s intrusion does not violate 
/ > 0.99. Thus QSDC operation is not possible unless 
Bob stores his modulated and amplified light for a Tm- 
duration interval prior to sending it to Alice, because he 
must ensure that the channel is safe to use for QSDC 
before he transmits his message. At a 50 km Alice-to- 
Bob path length, we have found Tm ~ Is [l^, making 
Bob’s optical storage out of the question with current 
technology. Absent a breakthrough in wideband, long- 
lived quantum memory, our approach to defeating active 
eavesdropping therefore restricts Alice and Bob to using 
their system for QKD 17|. That said, their secure rate 
at 50 km is orders of magnitude beyond what is possible 
with other QKD protocols, making it fast enough to sup¬ 
port one-time pad file encryption. The second point of 
note concerns the degree to which the active attack we 
have considered is the most powerful one that Eve could 
mount. We can show that Eve’s use of an SPDC source 
is her best beam-splitter active attack for a 3-mode Xbb 
when Ns <C 1 in that it nearly saturates the bound set 


by the entanglement-assisted Holevo capacity [1^. The 
same is true, without the Ns 1 restriction, for a two¬ 
mode active attack in which Ev e ig nores the light tapped 
from the Alice-to-Bob channel 181. 

Einally, it behooves to consider how close our pro¬ 
tocol might come to an ultimate limit. Takeoka et 
al. [l^ have shown that a two-way protocol for ei¬ 
ther QSDC or QKD that is carried out over a channel 
whose one-way transmissivity is ks has its bits/mode se¬ 
cure rate bounded above by 21 og 2 [(l + ks)/(1 — ks )]- 
It is not known, however, whether this bound is attain¬ 
able. The highest known achievable bits/mode secure 
rate is the — log 2 (l —Kg) rate of ideal continuous-variable 
QKD [^. Eigure 4(b) compares these rates with 
the bits/mode behavior of our ASE/homodyne system, 
whose bits/mode equals its bits/s divided by W, because 
operation is through single-mode fiber. We see that there 
is a substantial gap between our protocol’s bits/mode 
performance and the ultimate limit. Nevertheless, our 
protocol’s bits/s performance is orders of magnitude bet¬ 
ter than any existing QKD protocol because its modes/s 
value is set by the phase-matching bandwidth W ^THz, 
whereas both continuous-variable and discrete-variable 
QKD protocols have modes/s values set by electrical 
bandwidths that are ^GHz, unless wavelength-division 
multiplexing (WDM) is employed. WDM can also be ap¬ 
plied advantageously to our protocol, however, enabling 
it to maximize its overall secure rate—beyond what we 
have found for single-channel system—by operating each 
wavelength channel at the limit of BPSK-modulator and 
EDFA technology with the Pr(e)Aiice = 0.1 value needed 
for high-efHciency error correction. 

In conclusion, we have shown how a new two-way pro¬ 
tocol for secure communication can overcome the QI 
protocol’s problem of idler-storage loss limiting its rate- 
versus-distance capability against a passive eavesdrop¬ 
per, and how our protocol’s addition of coincidence- 
based channel monitoring can defeat active eavesdrop¬ 
ping. In doing so we found that entanglement is not 
essential to passive eavesdropping immunity: Eve’s in¬ 
ability to clone a low-brightness thermal-state signal 
beam suffices. Most importantly, our new protocol af¬ 
fords unprecedented rate-versus-distance QSDC capabil¬ 
ity against a passive eavesdropper and a similar QKD 
capability against an active eavesdropper. In both cases 
the parameter values we have assumed for our sources, 
optical amplifiers, photodetectors, and error-correcting 
codes are achievable with available technology. 

This research was supported by ONR grant num¬ 
ber N00014-13-1-0774, AFOSR grant number FA9550- 
14-1-0052, and the DARPA Quiness Program through 
U.S. Army Research Office Grant number W31P4Q-12- 
1-0019. 
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Supplemental Material 

PASSIVE EAVESDROPPING SETUPS 


0 


Figure 5 reprises the setups for our passive-eavesdropping analyses of the quantum illumination (QI) protocol from 
and the new protocol. 



FIG. 5: Setups for Ql-secured direct communication in the presence of passive eavesdropping. In the protocol from Q, Alice’s 
source is a continuous-wave spontaneous parametric downconverter whose signal she sends to Bob and whose idler she retains 
as a reference for the optical parametric amplifier receiver from 0- For the new protocol, Alice employs a source of amplified 
spontaneous emission noise to send a low-brightness signal to Bob while retaining a high-brightness copy for use as the local 
oscillator in a broadband balanced-homodyne receiver. 


For the QI version of this setup, Alice uses a spontaneous parametric downconverter (SPDC) source that emits 
M = TW independent, identically-distributed, signal-idler mode pairs in each T = 1/R duration bit interval with 
photon annihilation operators { {as^,ai^) : 1 < m < M}, where W is the SPDC’s phase-matching bandwidth and 
R is Bob’s modulation rate. Each such mode pair is in a zero-mean, maximally-entangled Gaussian state, i.e., a 
two-mode squeezed-vacuum state, that is characterized by its Wigner covariance matrix [7[, 


As/ 


1 

4 


2iVs + l 

0 

2^/Ns{Ns + l) 

0 


0 2^Ns{Ns + l) 0 

2iVs +1 0 -2^NsiNs + 1) 

0 2Ns +1 0 

-2^NsiNs + l) 0 2Ns + l 


( 1 ) 


where Ns -C 1. For the new protocol, Alice uses an amplihed spontaneous emission (ASE) source to obtain M = TW 
independent, identically-distributed, signal-reference mode pairs in each bit interval with photon annihilation operators 
{ ^Rm) ■ 1 < m < M}. The modes in each pair are in completely-correlated thermal states that are characterized 
by the Wigner covariance matrix. 


Ass 
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2Vs +1 0 2y/NsNi^o 0 

0 2Ns -b 1 0 2 v^7VsAlo 

2V^s^lo 0 2Vlo +1 0 

0 2.JNsNi^o 0 2Vlo +1 


( 2 ) 


of their joint state, where Ns < 1 Ni^q. 

In either case, propagation of the {aSml modes to Bob is through a pure-loss fiber channel with transmissivity ks, 
so that the modes he receives have annihilation operators 


^'sm = “S'™ + \/l - RS VSm ■ (3) 

where the noise modes {Ds„} are in their vacuum states. Bob imposes his message bit. A: = 0 or 1, on the {og } via 
binary phase-shift keying (BPSK) modulation and then amplifies the modulated modes with an erbium-doped fiber 
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amplifier (EDFA) with gain Gb and output ASE Nb- The modes that Bob then transmits to Alice therefore have 
photon annihilation operators 

aSm = (~1)^\/ Gb dsm \/ Gb — 1 (4) 

where the noise modes are in independent, identically-distributed, thermal states with = ^b/(,Gb — 

1). Propagation back to Alice through a pure-loss fiber channel with transmissivity ks results in a collection of return 
modes with photon annihilation operators given by 

“Sm = “s™ + \/l - Ks vb^ , (5) 

where the noise modes {vb^} are in their vacuum states. 

For the QI setup, the idler modes are stored in a pure-loss fiber spool—with transmissivity k/ = Kg, yielding 

“/m = 'S/m ! (6) 

where the noise modes {S/^} are in their vacuum states. The {dj } and the {d'g } are applied as inputs to an optical 
parametric amplifier (OPA) whose idler-mode outputs, 

Ooutm = '/G~Ad'i^ + VGa - 1 dl ^, for 1 < m < M, (7) 

are measured by quantum-efficiency ry direct detection of their photon flux over the bit interval. Alice then decides 
on the value of Bob’s message bit by comparing the outcome of that 


A^OPa = 2_^ a, 


M 

a't 

'OUt„ 

m—1 


( 8 ) 


measurement with a threshold value chosen to equalize her false-alarm and miss probabilities [8|, l22| . If the outcome 
exceeds that threshold she decides Bob sent fc = 0, otherwise she decides that he sent fc = 1. Here, we have accounted 
for the detector’s quantum efficiency by defining 


= y/v doutm + 


'^OUt„ 


(9) 


where the noise modes {'Doutm} are in their vacuum states. 

For the new ASF-based protocol, Alice detects the {ub^} modes using a balanced-homodyne arrangement and 
decides on the value of Bob’s bit by comparing the outcome of that 


A^hom — 


M 

E 

m—1 


{d. 


+m^+m “-m®- 


^ d' 


' ) 


( 10 ) 


measurement with zero. She decides that Bob sent /c = 0 if the measurement outcome exceeds zero, and she decides 
k = 1 otherwise [2^. In this expression, 

= 0? +V^-Vv±^, (11) 

where rj is now the homodyne detector’s efficiency, i.e., the product of its mode-mixing and quantum efficiencies, and 
the noise modes {f)±„} are in their vacuum states. 

The reference modes, {«//„}, undergo optical amplification, with gain Gr = IjKj and output ASE Nr = Gr, prior 
to being stored in a fiber spool. That spool, which has transmissivity k/, has its length chosen so that its output will 
be delay matched to the light Alice receives from Bob, resulting in 

= \0/ (\/ GRdR„ + Gr - 1 j +y/l- vr^ , (12) 

with the noise modes {vr^ } being in their vacuum states, and the noise modes {////„ } being in independent, identically- 
distributed, thermal states with {fiR^fil^ ) = Nr/{Gr — 1). For A^lo ^ 1, this amplify-then-store procedure leaves 
the average photon number of the reference almost unchanged and it preserves nearly-complete correlation between 
the stored reference and the signal beam that Alice sent to Bob. In particular, before storage we have that 

(“E ) = A^LO , 


(13) 












7 


and 




(14) 


while after storage we find that 


~ KiGrNi^o + KiNr = TVlo + 1 « -/Vlo, 


(15) 


and 


_ RiGrNsNi^o _ -/Vlo 

(ag^ds^)(d^^d^^) Ns{riGrNi,o + RiNr) IVlo + 1 


(16) 


when A^lo ^ 1 


24|. 


ACTIVE EAVESDROPPING SETUP 


Figure 6 reprises the setup for our active eavesdropping analysis. Now, Alice uses both SPDC and ASE sources. For 
each bit interval, the SPDC source produces M signal-idler mode pairs, with annihilation operators { (d|^'^^, : 

1 < m < M }, that are in independent, identically-distributed, zero-mean jointly Gaussian states that are characterized 
by the Wigner covariance matrix 



■ 2Vspdc + 1 

0 

Cspdc 

0 

1 

0 

2A^spdc + 1 

0 

—Cspdc 

4 

Cspdc 

0 

2AIspdc + 1 

0 


0 

—Cspdc 

0 

2A^spdc + 1 - 


(17) 


where Vspdc 1 and Cspdc = 2\/Vspdc(A^SPdc + !)• For each bit interval, the ASE source produces M signal- 
reference mode pairs, with annihilation operators { ( QjQ ^ ) : 1 < m < M }, that are in independent, identically- 

distribution, completely-correlated thermal states that are characterized by the Wigner covariance matrix. 


A ASE _ 1 
^SR -4 


2iVASE + 1 0 2 V AaseA^lo 0 

0 2Vase + 1 0 2v^AaseA^lo 

2-\/AaseAlo 0 2iVLo + 1 0 

0 2-v/]VaseAlo 0 2Vlo +1 


(18) 


where Aase = 1 < A^lo- 



FIG. 6: Setup for defeating active eavesdropping by coincidence monitoring. 
























































Alice sends her SPDC’s idler beam to her channel monitor, and combines her SPDC and ASE source’s signal beams 
on an asymmetric beam splitter and transmits the ontpnt modes, 

aSm = \/^+ VI - ka Os®®, (19) 

to Bob. Because she wants each of these output modes to have average photon number Ns < 1, and she wants 99% 
of the light going to Bob to come from her ASE source, Alice uses = 1 — 0.99A^5 and adjusts her downconverter’s 
pump power to obtain A^spdc = A^s/lOO)! — 0.99A^5). Note that for Ns < 0.1 these choices imply ka > 0.9. It 
follows that the signal modes Alice sends to Bob, her SPDC idler modes, and her ASE reference modes—denoted 
{ (®Sm I I ^ ^ "m < M }—are independent, identically-distributed, mode triples. Each such mode triple is in 

a zero-mean Gaussian state that is completely characterized by the Wigner covariance matrix 


As/fl 


1 

4 


■ 2Ns + l 

0 

V^Cspoc 

0 

Case 

0 


0 -/kaCspdc 

2Ns + 1 0 

0 2A^spdc + 1 


— V^CsPDC 0 

0 0 

Case 0 


0 Case 0 

—v^kJCspbc 0 Case 

0 0 0 

2A'spdc + 1 0 0 

0 2Nlo +1 0 

0 0 2Ni^o +1 


( 20 ) 


where Case = 2-\/(l — ka)NaseNi,o- 

Eve replaces the lossy fibers that had connected Alice and Bob with lossless fibers into which she has inserted beam 
splitters with transmissivities kab for the Alice-to-Bob channel and kba for the Bob-to-Alice channel. She has her 
own SPDC source (with the same phase-matching bandwidth as Alice’s), whose M signal-idler pairs are independent 
and identically distributed with each mode pair, (ag™,aj™), being in a zero-mean, maximally-entangled Gaussian 
state characterized by the Wigner covariance matrix, 

2AfEve+l 0 2v'NEve(ArEve + 1) 0 

0 2A^Eve + 1 0 — 2-\/ NEvei^Eve + 1) 

2v'iVEve(A^Eve + 1) 0 2NB.e + 1 0 

0 — 2-\/ A^Eve(A^Eve + 1) 0 2A^Eve + 1 

Eve injects her SPDC’s signal beam into the Alice-to-Bob channel through her kab beam splitter, so that the mth- 
mode signal light that Bob receives has annihilation operator 

= y/KAB as^ + Vl — I^AB of™, (22) 

and she taps light from the Bob-to-Alice channel via her kba beam splitter, so that the mth-mode return light that 
Alice receives has annihilation operator 


A Eve _ 


= y/l^BA aBm + Vl — I^BA VBA„,, (23) 

where the noise mode VBAm is in its vacuum state. Now, because Bob uses a transmissivity -kb beam splitter to divert 
part of the light he receives from Alice to his channel monitor, ob^ in Eq. (I23p is given by 

“Bm = (—1)^-\/ Gb [a/I — Kb a's^ + a/kb i^Bm] + VGb — 1 Bb,„j (24) 

instead of by Eq. ®, with the noise mode v'b^ being in its vacuum state. 

Eve attempts to determine the full string of bits that Bob has sent by joint measurement of the light she taps from 
the Alice-to-Bob channel. 


— a /1 ~ I^AB ~ a /^AB 

her retained idler modes {af™}, and the light she taps from the Bob-to-Alice channel, 


(25) 
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carried out over all Bob’s transmitted bits. 

Bob uses a beam splitter (whose free input-port modes are in their vacuum states) to divert a fraction of the 
light he receives to his channel monitor, sending the rest to his BPSK modulator and EDFA for transmission back 
to Alice. To minimize the detectability of her attack, Eve chooses A^Eve, hab, and kba so that: (1) Bob receives an 
average photon number just as he did in Eve’s absence; (2) the fraction, 1 — /, of light entering Bob’s terminal 

that is due to Eve’s injection is 0.01; and (3) Alice receives an average photon number ks[Gb(1 — kb)ksNs + Nb], 
just as she did in Eve’s absence. These objectives are satisfied when kabNs -I- (1 — KAB)A^Eve = ks^s, f = 
1 — (1 — KAB)NEve/KsNs = 0.99, and kba = Kg. Alice makes her decision about Bob’s message bit by comparing 
the outcome of her homodyne measurement—as described in Sec. I —with zero, and deciding that Bob sent fc = 0 if 
the measurement outcome exceeds zero and deciding fc = 1 otherwise. 


ALICE’S ERROR PROBABILITIES AND ALICE AND BOB’S SHANNON INFORMATION RATES 

Because M > 200 for all the performance evaluations presented in the paper, we can use the Central Limit Theorem 
to justify the following Gaussian-approximation formulas for Alice’s error probabilities Q when Bob’s bit value is 
equally likely to be 0 or 1 and Eve mounts a passive attack against an SPDC/OPA system or an ASE/homodyne 
system: 


Pr(e) 


OPA _ 
Alice 


Q 


,,OPA ,,OPA\ 
Mo Ml \ 
^OPA + ^pPA^ 


(27) 


Pr(e) 


ASE _ 
Alice 


Q 


,,ASE 

PO 


,,ASE 

PI 


^ASE 


-I- CT 


ASE 


(28) 


where 


Q{x) 



(29) 


Here, and are the conditional mean and conditional standard deviation of the iVopA measurement given 

the value of Bob’s message bit, fc, when Eve makes a passive attack. Likewise and are the conditional 
mean and conditional standard deviation of the iVhom measurement given the value of Bob’s message bit, fc, when Eve 
makes a passive attack. A similar Gaussian-approximation formula applies when Bob’s bit values are equally likely 
to be 0 or 1 and Eve makes an active attack: 


Pr(e)lle = Q 


,,&ct _ ,,3,ct \ 

Mo ~ Ml \ 

^act _i_ ^act / ’ 
•^0 ‘^1 / 


(30) 


with and being the conditional mean and conditional standard deviation of the Ahom measurement given 
the value of Bob’s message bit, fc, when Eve makes an active attack and Alice and Bob perform channel monitoring. 

Once Alice’s error probabilities are found, Alice and Bob’s Shannon-information rates (in bps) follow immediately 
from 


IaB = i?{l + Pr(e)Alicel0g2[Pr(e)Alice] + (1 - Pr(e)Alice)l 0 g 2 [l - Pr(e)Alice]}, (31) 

hence all that remains is to determine the conditional means and standard deviations needed to instantiate our 
error-probability formulas. These conditional moments are easily calculated from the state characterizations and 
annihilation-operator transformations in the first two sections of this Supplemental Material, so we will merely present 
the results. For passive eavesdropping on the SPDG/OPA system we have 

~ {Gap/As -|- (Ga ~ 1)[ks(Gb«:sA5 -|- Nb) + 1] 

+ 2(-l)yGA(GA - 1 )k74GbAs(As + 1)|, (32) 


^OPA 


(33) 
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while for passive eavesdropping on the ASE/homodyne system we have 

= 2{-l)'^Mr)KsVGBNsNLO, (34) 

= ^MMkIGbNs + ksNb + iVLo) + 2i^^2kIGbNs + ksNb)Ni,o}, (35) 

where perfect reference storage has been assumed [2^. At this point we can obtain the asymptotic (A^b,1Vlo ^ 1) 
form of Pr(e)ASE (e) that was used for illustrative purposes in the paper, albeit not in the performance-evaluation 
figures. In this asymptotic regime we have that 

^ ^2Mr]^BsNBNi^o, (36) 

whence 

Pr(e)Afice ^ q(^^/2MksGbNs/Nb) < eM-Wt^sGBNs/RN b)/2, (37) 

where we have used the well-known bound Q{x) < exp(—a;^/2)/2 for a; > 0, and M = W/R. In the paper, this 
asymptotic expression was quoted for ideal equipment, which presumes unity homodyne efficiency {rj = 1). The 
derivation we have just given verifies that in this asymptotic regime Pr(e)^‘ilj.g is not sensitive to the homodyne 
efficiency. Thus the 77 = 0.9 homodyne efficiency assumed in the paper is not a critical value. 

For active eavesdropping on the ASE/homodyne system with channel monitoring we have the 

^act _ 2( — l)^Mr]y/ KbaGb(1 — KB)KylB(l — Ka)A^aSeA^LOi (38) 

+ Alo] + 2tj^N^^^Nlo + kbaGb{1 - kb)kab(1 - ka)NaseNlo]}, (39) 

where = kbaGb(^ — kb)ksNs + kba^b and perfect reference storage has been assumed [^ . 


UPPER BOUNDS ON EVE’S HOLEVO INFORMATION RATES 

For any of our configurations—passive eavesdropping on the SPDC/OPA system, passive eavesdropping on the 
ASE/homodyne system, and active eavesdropping on the ASE/homodyne system with channel monitoring—Eve’s 
Holevo information rate is given by 


Xeb 


S{pB)-Y.SiP^E)/‘^ 

k=0 


R, 


(40) 


where S{-) denotes von Neumann entropy, is Eve’s conditional joint density operator for the modes she collects 
that are associated with a single message bit from Bob when that bit’s value is fc, and is her 

unconditional joint density operator for those modes. To place an upper bound on xeb we will follow the procedure 
used in [1,|^ for the passive eavesdropping attack. There, because the conditional joint density operators were Gaussian 
states, their von Neumann entropies were evaluated exactly by symplectic diagonalization of the conditional Wigner 
covariances A^^ [ 2 ^. The unconditional joint density operator, however, was not a Gaussian state, but it was zero- 
mean with a diagonal Wigner covariance matrix Ae = meaning that all its modes were uncorrelated. 

The joint state with that covariance matrix which has the highest von Neumann entropy is a collection of independent 
thermal states whose average photon numbers are directly related to those diagonal elements. Moreover, Bob’s i?bps 
information rate is an upper bound on Eve’s Holevo information rate, i.e., she cannot glean more information than 
what Bob sends. Taken together, these results lead to the following upper bound on Eve’s Holevo information rate 
for the passive eavesdropping attack ii: 


Xeb = min 


^therm(Ais)-^^(pL"V2,l 




i?, 


( 41 ) 


where S'therm(A£;) is the von Neumann entropy of a multi-mode thermal state with covariance matrix Ae- 
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For the passive eavesdropping configurations considered in the present paper, Eve collects all the light lost 
in propagation between Alice and Bob, i.e., for each of Bob’s message bits she has access to M mode pairs, 
{ (®!Ib ) : 1 < m < M }. Given Bob’s bit value is fc, these mode pairs are in independent, identically- 

distributed, zero-mean Gaussian states, implying that 

S{pf) = MS{pf), (42) 


(k) 

where is the common conditional joint-density operator for a mode pair. That mode-pair conditional density 
operator is completely characterized by the Wigner covariance matrix 


a(g - 


2{1-ks)Ns + 1 u \-^) ^ab 


0 

(_l)fc^pa^ss 

0 


0 (- 1 )'=C'^ 5 " 0 

2(1 - ks)Ns + 1 0 (-l)'=GrB 


0 




2 A^P’^" -b 1 
0 


0 

27VP“" -b 1 


(43) 


where = 2(1 — ks)VGbks Ns and ~ ks){GbksNs + Nb)- Moreover, averaging over Bob’s equally- 

likely message-bit distribution, we have that has a AM x AM Wigner covariance matrix that is block diagonal 
with common 4x4 blocks on its diagonal that are themselves diagonal and given by 
1 

Kab = Y. ^aI/‘^ = 4 diag[ 2(1 - ks)Ns + 1 2(1 - ks)Ns + 1 2iVP7 + 1 2 IVP 7 + 1 ] . (44) 

k^O 

With these covariance matrices in hand, the procedure from [§, that was described above can be used to evaluate 
the Xeb result from Eq. (liTl) . 

The process to evaluate Xeb for an active attack is slightly more complicated, because for each of Bob’s message 
bits Eve now has access to M mode triples, { (d^B > dj™) d^™ ) : 1 < m < M }. Given Bob’s bit value, k, these mode 
triples are in independent, identically-distributed, zero-mean Gaussian states that are characterized by the Wigner 
covariance matrix. 



■ 2N^^ + 1 

0 

/^act 

~^AI 

0 


0 


0 

2N^^ -b 1 

0 

/^act 

^AI 

0 


1 

/^act 

~^AI 

0 

2AEve + 1 

0 


0 

4 

0 

/^act 

^AI 

0 

2NEve + 1 

0 

(_l)fe-Hl(^art 



0 


0 

2N^^X + 1 

0 


0 


0 

(_l)fe+l(^art 

0 

2N^^X + 1 


where 

^AB = [(1 ~ kab)Ns + KabN^vb], 


(45) 


(46) 


C^j = 2\J KABNEve{NEve + 1), (47) 

GTb = 2-\/ (1 — kba)Gb(1 — kb)(1 — kab)kab {Ns — Nevb), (48) 

Gib = 2\/ (1 — AtBA)GB(l — Kb)(1 — KAB)NEveiNEve + 1), (49) 

Nba = (1 - «;ba)[Gb(1 - tiB)nsNs + Nb]. (50) 


The conditional von Neumann entropies that we need are obtained by symplectic diagonalization of the JA^aib- Aver¬ 
aging over Bob’s equally-likely message-bit distribution, we have that Pb has a 6 M x 6 M Wigner covariance matrix 
that is block diagonal with common 6 x 6 blocks on its diagonal given by 


A 


AIB 


= EA 


(^) /9 _ 

AIB! ^ — 



■ 2NX% + 1 

0 

/^act 

^AI 

0 

0 

0 


0 

2NX% + 1 

0 

/^act 

^AI 

0 

0 

1 

/^act 

^AI 

0 

2A^Eve + 1 

0 

0 

0 

4 

0 

/^act 

^AI 

0 

2NEve + 1 

0 

0 


0 

0 

0 

0 

2N%‘^X + 1 

0 


0 

0 

0 

0 

0 

2N%‘^X + 1 


(51) 
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This covariance matrix indicates that the modes have a phase-sensitive cross correlation, but they 

are both uncorrelated with the mode. Performing a symplectic diagonalization of the submatrix associated 

with the correlated modes, we can obtain the average photon numbers of three uncorrelated modes, the sum of whose 
thermal-state von Neumann entropies is an upper bound on S{p^). In this manner we can complete evaluating the 
Xbb result from Eq. (14111 for the active attack. 


CHANNEL MONITORING 


Alice and Bob use channel monitoring—measuring their singles rates, Sa and Sb, and their coincidence rate. Cab, 
to constrain the fraction of light entering Bob that comes from Eve’s active attack. Their monitors will be assumed to 
have detectors with quantum efficiencies ry and jitter-limited coincidence-gate times Tg ^ 100 ps. When the average 
number of photons illuminating each monitor in a gate time is much smaller than one—as will be the case for our 
performance evaluation—the average values of the preceding rates can be taken to be 


27| 


Sk = 


V_ 

T„ 


iorK = A,B, 


(52) 


and 


Cab = 


T, 


dt 


du (i (<)£^b (u)) 


(mont / 


(53) 


g JO 


where for K = A, B. are the positive-frequency, photons/sec-units field operators entering Alice and Bob’s 

monitors. For phase-matching bandwidths of interest, we will have TgW 3> 1, so that we can replace the average 
photon-flux integrals in the preceding expressions with sums of photon-number operators for those fields’ Fourier-series 
decompositions on the [0,rg] time interval. We thus obtain 


Sk 


M„ 


T„ 




), 


m—l 


(54) 


and 


M„ 


Cab = ^ E E<^“ 

J- r 


monf - mon - mont - mon 

“b. 




(55) 


where Mg = TgW. The mode pairs {(aA™,^^™) : 1 < m < Mg} are in statistically independent, identically 
distributed, zero-mean Gaussian states that are characterized by the Wigner covariance matrix 


A 


mon 

AB 


1 

4 


SA^spdc +1 0 V kb/kska Gspdc 0 

0 2Aspdc +1 0 —V kb/kska Gspdc 

Vkb/kska Gspdc 0 2KBKsNs + i 0 

0 —Vkb/kska Gspdc 0 2kbksNs + 1 


(56) 


from which we immediately get 


Sa = rjNspDcW, (57) 

Sb = VkbksNsW, (58) 

and, after use of Gaussian-state moment factoring [28| . 

Cab = SASBTg + tf kb/kskaNspdcW. (59) 

Of course, Alice and Bob cannot exactly measure these ensemble average rates. Instead, they rely on time-average 
singles-rates and coincidence-rate measurements— Sa{Tm), Sb{Tm), and Cab(Tm) —made over a Tjvr-s-long mea¬ 
surement interval, where Tm ^ Tg. These are all unbiased estimators, i.e., (5 a(7m)) = ■S'a, {Sb(Tm)) = Sb, and 
{Cab{Tm)) = Cab- Furthermore, the signal-to-noise ratios (SNRs) of the singles-rate measurements, 

SNR^ = SkTm, for K = A, B, (60) 

Var(S'if) 
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will both be much greater than unity when Tm > 0.1s for the parameter values of interest. For example, with 
rj = 0.9, A^spdc = 10“^, and W = 2THz, we have SNR^ > 82.5 dB when Tm > 0.1 s. Likewise, for rj = 0.9, Ns = 0.1, 
W = 2THz, Ks = 10“^, and kb = 0.1, we have SNR^ > 72.5 dB when Tm > 0.1s. Thus in assessing how much time 
Alice and Bob will need to ensure that Eve is constrained to 1 — / = 0.01 fractional illumination of Bob’s terminal, 
we will assume that their singles-rate measurements are perfect. So, Alice and Bob can then estimate / using 


/(Tm) 


{Cab{Tm) — SASBTg)Ns 
tikaNsp-dcSb 


(61) 


where all of the parameters entering this estimator can be accurately calibrated. 

It is easy to see that /(Tm) is unbiased, i.e., (/(Tm)) = /. To ensure that Alice and Bob can accurately decide 
that / = 0.99, we shall require that /{TmYs standard deviation be Sf < 10“^. We have that 


The variance term on the right satisfies 

VariC^B (Tm)] 


Sf = 


Y/var[C^B(TM)] Ns 
Vi^aNspdcSb 


/ M, 

-Var I 


M, 


\ m—1 n=l 


^mon't-mon'-mon't-mon' 
^Am ^Bn 


(62) 


(63) 


where 


ax:' = ^ax:+ 
axr' = 


(64) 

(65) 


with the noise inodes IIb™} being in their vacuum states. Equation (l63ll can be evaluated from Gaussian-state 

moment factoring, with the following result, 


Var[C^B(TM)] 


77'^/vbA^spdcIF 

Tm 


X [kab^A + {ksNs + 2K,ABKANsPP)c)Mg + (1 + 2kbKsHa + fiBKsNs)KsMgNs] , (66) 


where higher-order terms in IVspdc and Ns have been neglected because their contributions are insignificant for 
the parameter values of interest. Using this result in Eq. (l62|) . we obtained the plot shown in Eig. 7 for the Tm 
value needed to get 6f = 10“^, when Alice and Bob’s monitors have quantum efficiencies rj = 0.9, and all the other 
parameters are those given in the paper for the performance curves shown in its Fig. 4(a). 



FIG. 7: Time duration Tm needed for Alice and Bob’s channel monitoring to validate / > 0.99 within a ±0.001 standard 
deviation. 
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